mcp-manager

name	mcp-manager
description	Discover and invoke MCP tools registered in `.pentester/mcp/`. Automatically consulted before each PTES phase. Manually triggered via /pentester:mcp.

MCP Tool Manager

Manage and invoke Model Context Protocol (MCP) tools for penetration testing. MCP servers are hosted externally; this skill manages client-side discovery and invocation.

When to Use

• 自动触发：每个 PTES 阶段开始前，ROLE.md §5 要求检查 mcp/INDEX.md
• 用户要求 "调用 MCP 工具"、"执行扫描"、"使用自动化工具"
• 发现可用 MCP 工具注册在 .pentester/mcp/ 时

How to Use

Step 1: Discover Available Tools

Open .pentester/mcp/INDEX.md to see all registered MCP tools by category.

Each tool has its own subdirectory under .pentester/mcp/<tool-name>/ with:

• README.md — Tool description, parameters, server endpoint, invocation examples
• examples.md — Usage examples with sample inputs/outputs

Step 2: Read Tool Specification

For the selected tool, read its README.md to understand:

• What the tool does (capabilities and limitations)
• Parameters required (endpoint, authentication, input format)
• Output format (how results are returned)
• Risk level and authorization requirements

Step 3: Invoke the Tool

Invocation method depends on how the tool is implemented:

Method A: Via Pi Extension (preferred if available)

If a pi extension registers the tool via pi.registerTool(), call it directly as a built-in tool.

Method B: Via MCP CLI Client

# Using mcp-cli or similar client
mcp call <server-name> <tool-name> --params '{"key": "value"}'

Method C: Via HTTP (if server exposes HTTP endpoint)

curl -s -X POST <server-url>/call \
  -H "Content-Type: application/json" \
  -d '{"tool": "<tool-name>", "params": {"key": "value"}}'

Step 4: Process Results

• Parse the tool output and extract relevant findings
• Write findings to target/${IP}/ following the project data structure
• If the tool discovered new vulnerabilities or methods, consider recording via knowledge-base skill

Phase-Specific MCP Tool Lookup

PTES Phase	MCP Tool Category to Check
Pre-engagement	Scope/target initialization tools
Intelligence Gathering	Information gathering tools
Vulnerability Analysis	Vulnerability scanning/analysis tools
Exploitation	Exploitation tools
Reporting	Report generation tools

Safety Rules

• Never pass target credentials or API keys in plaintext in tool parameters unless authorized
• Verify tool risk level before invocation (check README.md risk section)
• Document all tool calls and results in target/${IP}/
• If a tool performs destructive actions (write, delete, modify), pause for user confirmation
• Report any MCP server connection issues to the user